Often in our network, we understand that we can't fix every flaw or vulnerability.
Sometimes the flaw is too expensive.
The the technology isn't available or if it is available, we don't have access to it.
There's different flaws specific to use cases.
Maybe we have a machine that we're supporting, that we can't implement
the patch or the control that would fix the issue because of
the way it interacts with the software that's running on the server.
There's all kinds of different reasons that we
can't fix a security flaw or vulnerability.
The way we, we would like to,
we ought to refer to this as utilizing compensating controls.
Compensating controls are a temporary fix for an unavailable reason that we
would normally fix that problem or flaw or vulnerability within our system.
For instance,
if I have a security device that is completely compromised during an attack,
it may be considered time to restore or replace that device.
But in the meantime,
we can use a compensating control to reroute traffic or
to better secure that specific device or that specific flaw.
When we talk about compensating controls,
we need to understand that it meets the intent or the rigor of the
original requirement of the device.
We're trying to fix a compensating control is not just throwing
a band aid while the system is still hemorrhaging data.
A compensating control is hey, we have a data breach. Let's stop it now.
And by stopping it now we're going to do X
that X stops all the data breach from happening.
It may have other circumstances behind it. That doesn't really help us that much.
But for a compensating control,
it still provides us that unique perspective of stopping the flaw in its tracks.
When we have a flaw or a vulnerability within a system,
we often look to fixing that problem right off the get go.
There's many ways to fix a problem.
But there's often a best case scenario, sometimes that
case scenario is patching the vulnerability.
And while we would love to be able to patch
every single vulnerability or flaw that comes in our system,
sometimes that's just not capable.
We've got problems like older servers that may be running software where the patch,
if we implement it would shut down that entire service.
Yet that service is literally providing funding for an entire company.
It is not practical to stop or to patch that system because of this.
We often see data or if there's a data breach occurring,
that we need to put a stop to it immediately.
And while the best way of doing it isn't within our financial means or
we don't have the capability or capacity
to implement that defense against it immediately.
We have to come up with something
we can utilize a compensating control to fix that
flaw or fix that vulnerability in a temporary standpoint.
The compensating control needs to come into play and
provide the same rigor as the original requirement.
It needs to provide the same level of defense and it grows
to either go to the level or beyond the original level of providing
a fix for that original data breach.
We may need to mitigate the existence of the problem that is in play at the time.
A compensating control is not a band aid.
We're not providing a short term fix that doesn't
provide 100% of the stoppage of the data breach.
It needs to provide the same level that the original fix would have provided
with that said
we go into the fact of knowing that compensating controls are often our one dech
effort to fix a problem when we don't always have the money, the finances,
the availability
or the original uh uh safeguard that we would originally put into place.
There are different control types that we need to be aware of.
Managerial, technical and operational.
The managerial controls also referred to
as administrative controls are controls that are
developed or implemented as part of the
overall security process utilized for people.
More often than not.
We're talking about account management policies, media equipment use policies,
acceptable use policies, incident response plans and procedures,
security awareness and training
plenty much when we talk about managerial or administrative controls,
think paperwork, we're doing paperwork to stop a problem.
If I got employee that's constantly clicking on that phishing link,
we could create a policy that says, hey, don't do that or we're going to get fired.
That's a managerial administrative control that we're putting
in place to stop someone from doing something.
They shouldn't.
We're adhering to that
human nature, so to speak. When it comes to managerial policies,
technical controls are controls that we utilize on a technical nature.
Just like it sounds, we can use firewall configurations,
outlining access control lists we can go through and we can see, hey,
I need to reconfigure this device to counter this problem.
When we talk about technology controls,
we're really thinking about patch management.
We're thinking about, hey, how do I effectively use technology to solve a problem?
This is the adherence to a technical control.
Finally, we look at operational controls.
Operational controls are tools that may be
traditionally physical or operational in nature.
This would be things like, hey, let's lock the gate.
Let's put up a boundary inside of our network.
From the perspective of I don't want anybody to go through this door.
Let's put a padlock on the door and then secure it with a bar.
Maybe we have a problem with our uh humidity inside of our server room.
Let's purchase a humidifier.
Maybe we need video surveillance.
Maybe we need to go through and hire some extra security guards,
operational controls or anything that's not technical in nature.
It's not necessarily administrative in nature,
but it still provides a control that stops people from doing stupid things.